authgear / authgear/authgear-server

[Whatsapp OTP] Error message when Double Login from 2 different browsers

Open
#2,064 0 comments 0 reactions 0 assignees View on GitHub
bug/minor reported by qa
Dominant language
Go
Stars
2k
Forks
125
Avg merge
2d 17h
Merged PRs (30d)
32

Description

bug/minor

## Background:
- Device / Browser (OS version): Chrome on Mac
- Build: Version tag 2022-05-11.0

## Description:
Error message when Double Login from 2 different browsers, one of the browser will show error message `code web session id doesn't match current web session id`

## Steps to reproduce:
1. [Browser A] Login with phone number
2. [Browser B] Login with the same phone number
3. In Whatsapp, send 2FA from browser A
4. See browser B said `You have entered a wrong code.`
5. [Browser A] Under "Do you want to resend it?", click Refresh, see error message `code web session id doesn't match current web session id`
6. In Whatsapp, send 2FA from browser B
7. See Browser B successfully logged in
8. [Browser A] Under "Do you want to resend it?", click Refresh, see error message gone, 2FA still the same
9. In Whatsapp, send 2FA from browser A
10. See Browser A still not logged in, but 2FA won't update anymore

## Expected result:
Provide clearer error message when there are 2 concurrent web session.

If the app don't support multiple login, kick the first login out, i.e. Browser A
If the app support multiple login, find ways to let them both login, find ways to tell browser A that the first 2FA is no longer valid and issue new 2FA.

## Screenshot:
Left Browser A, Right Browser B

https://user-images.githubusercontent.com/4337525/172125168-7dc6c00b-7a54-46d1-ac96-9f50abfe4cfe.mp4

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the two-browser WhatsApp OTP sequence described in the issue and trace the web-session and 2FA flow that produces the session-mismatch error. First clarify whether concurrent logins are supported; done means the chosen behavior is implemented, the affected browser receives a clear message, and the stale 2FA code cannot leave either login stuck.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
authentication, backend
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.